Gate GDI APIs behind IsUser32AndGdi32Available in cfgas_fontmgr.cpp
Under win32k lockdown, which is detectable using the
IsUser32AndGdi32Available helper function and used in chromium renderer
and service sandboxes, APIs which call into win32k.sys like GetDC,
EnumFontFamiliesExW, ReleaseDC will no-op in the kernel and fail or
return no data.
We're planning make chromium changes that will cause the DLLs hosting
these APIs to fail to load (and crash in the delayload runtime) under
win32k lockdown, adding these if checks will prevent us from trying to
load the dlls.
Locally validated we no longer see test failures seen in some of the
chromium PDF browser tests when 'WinSboxNoFakeGdiInit' chromium
feature is enabled.
Bug: pdfium:2140
Change-Id: Ibc9a243cd7e2625ebc6e0553400e83fc07464bfc
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/117353
Reviewed-by: Thomas Sepez <tsepez@google.com>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/xfa/fgas/font/cfgas_fontmgr.cpp b/xfa/fgas/font/cfgas_fontmgr.cpp
index 242ce6e..28d46fc 100644
--- a/xfa/fgas/font/cfgas_fontmgr.cpp
+++ b/xfa/fgas/font/cfgas_fontmgr.cpp
@@ -36,6 +36,10 @@
#include "xfa/fgas/font/cfgas_gefont.h"
#include "xfa/fgas/font/fgas_fontutils.h"
+#if BUILDFLAG(IS_WIN)
+#include "core/fxcrt/win/win_util.h"
+#endif
+
namespace {
bool VerifyUnicode(const RetainPtr<CFGAS_GEFont>& pFont, wchar_t wcUnicode) {
@@ -191,6 +195,12 @@
std::deque<FX_FONTDESCRIPTOR> EnumGdiFonts(const wchar_t* pwsFaceName,
wchar_t wUnicode) {
std::deque<FX_FONTDESCRIPTOR> fonts;
+ if (!pdfium::IsUser32AndGdi32Available()) {
+ // Without GDI32 and User32, GetDC / EnumFontFamiliesExW / ReleaseDC all
+ // fail.
+ return fonts;
+ }
+
LOGFONTW lfFind;
memset(&lfFind, 0, sizeof(lfFind));
lfFind.lfCharSet = DEFAULT_CHARSET;
